Drive-by-download attack exploits critical vulnerability in Windows Media Player

Web attackers are exploiting a recently patched Windows Media Player vulnerability to infect computers with malware

Security researchers from antivirus vendor Trend Micro have come across a Web-based attack that exploits a known vulnerability in Windows Media Player.

"Earlier today, we encountered a malware that exploits a recently (and publicly) disclosed vulnerability, the MIDI Remote Code Execution Vulnerability (CVE-2012-0003)," Trend Micro threat response engineer Roland Dela Paz said in a blog post on Thursday.

The security flaw can be exploited by tricking the victim into opening a specially crafted MIDI (Musical Instrument Digital Interface) file in Windows Media Player.

Microsoft released a security fix for it on Jan. 10, as part of its monthly patch cycle. "An attacker who successfully exploited this vulnerability could take complete control of an affected system," the company said at the time.

The so-called drive-by-download attack identified by Trend Micro researchers uses a malicious HTML page to load the malformed MIDI file as an embedded object for the Windows Media Player browser plug-in.

If successful, the exploit downloads and executes a computer Trojan on the targeted system, which Trend Micro detects as TROJ_DLOAD.QYUA. "We're still conducting further analysis on TROJ_DLOAD.QYUA, but so far we've been seeing some serious payload, including rootkit capabilities," Dela Paz said.

It's not yet clear how victims are being tricked into visiting the malicious page, but the attack doesn't appear to target a particular organization or group of people, said David Sancho, a senior antivirus researcher at Trend Micro.

According to the researcher, the attack is not widespread at the moment, but it is possible that other attackers will start exploiting the same vulnerability in the near future. "As mentioned, this is a publicly disclosed vulnerability so we can expect similar attacks in the future," Sancho, said.

Trend Micro advises users to install the security patches described by Microsoft in its MS12-004 security bulletin. The vulnerability affects Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008, but not Windows 7 or Windows Server 2008 R2.

As a general rule, users should always keep their operating systems and other software installed on their computers up to date in order to avoid becoming victims of drive-by-download attacks. Running an antivirus program capable of scanning Web content at all times is also recommended.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Bitdefender 2019

Bitdefender solutions stop attacks before they even begin! Get cybersecurity that 500 MILLION users already have and trust.

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?